My colleague Mirko Schmidt gave me the helpful advise of upgrading the Puppet agent – ignoring the official support matrix. My systems were using the Puppet agent from the EPEL repository – in a very old version:

With this change, also configuration file paths change. Files below /etc/puppet can be found under /etc/puppetlabs/puppet after the upgrade.

As the whole agent is replaced it is necessary to re-configure the software. Existing configuration files might be used furthermore. I suggest creating a backup of the new agent’s configuration files before moving the old configuration:

Before starting the new agent, make sure to remove the former certificate from the Smart Proxy. For this, click Infrastructure -> Smart Proxies -> Proxy -> Puppet CA -> Certificates -> Revoke in the Foreman interface.

Revoking Smart Proxy Puppet certificates

Afterwards, run the Puppet agent in order to create and submit a new SSL certificate for the Smart Proxy.